I wouldn't be surprised. As far as I know, it's not at all difficult for a programmer to write a malicious program that looks like a facebook app and because they all need to access your information to work, no one questions it. I've read more than one article about someone making a fake app and getting 1000s of names and addresses and stuff within hours of releasing it to the community.